mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.4 KiB
2.4 KiB
API Reference: QR Code Phishing Detection
pyzbar — QR/Barcode Decoding
Installation
pip install pyzbar Pillow
# On Linux: apt-get install libzbar0
Core Functions
from pyzbar.pyzbar import decode
from PIL import Image
results = decode(Image.open("qr.png"))
for r in results:
print(r.type) # "QRCODE"
print(r.data) # b"https://..."
print(r.rect) # Rect(left=40, top=40, width=200, height=200)
Decoded Object Attributes
| Attribute | Type | Description |
|---|---|---|
data |
bytes | Decoded content |
type |
str | Barcode type (QRCODE, EAN13, etc.) |
rect |
Rect | Bounding rectangle |
polygon |
list | Corner points |
quality |
int | Decode quality score |
Python email Module — EML Parsing
Parsing an EML file
import email
from email import policy
with open("message.eml", "rb") as f:
msg = email.message_from_binary_file(f, policy=policy.default)
subject = msg["Subject"]
sender = msg["From"]
Walking MIME Parts
for part in msg.walk():
ctype = part.get_content_type()
if ctype.startswith("image/"):
payload = part.get_payload(decode=True)
filename = part.get_filename()
URL Analysis Indicators
Suspicious TLD List
.xyz, .top, .club, .work, .buzz, .tk, .ml, .ga, .cf, .gq
Phishing URL Patterns
| Pattern | Risk |
|---|---|
| IP address in domain | High |
| Domain > 40 chars | Medium |
| HTTP (no TLS) | Medium |
| 3+ subdomains | Medium |
| URL shortener | High |
| Base64 in path | High |
Microsoft Defender for Office 365 — Safe Links API
Check URL reputation
POST https://graph.microsoft.com/v1.0/security/tiIndicators
Content-Type: application/json
Authorization: Bearer {token}
{
"targetProduct": "Azure Sentinel",
"threatType": "Phishing",
"url": "https://suspicious-domain.xyz/login"
}
VirusTotal URL Scan API
Submit URL
POST https://www.virustotal.com/api/v3/urls
x-apikey: {API_KEY}
Content-Type: application/x-www-form-urlencoded
url=https://suspicious-domain.xyz
Response Fields
| Field | Description |
|---|---|
data.attributes.last_analysis_stats.malicious |
Engines flagging as malicious |
data.attributes.last_analysis_stats.harmless |
Engines flagging as clean |
data.attributes.categories |
URL categorization |